Are we able to whitelist a subnet of IPs?

[shanaver]

For example, all of CloudFlare's IPs:

199.27.128.0/21
173.245.48.0/20
103.21.244.0/22
103.22.200.0/22
103.31.4.0/22
141.101.64.0/18
108.162.192.0/18
190.93.240.0/20
188.114.96.0/20
197.234.240.0/22
198.41.128.0/17
162.158.0.0/15
104.16.0.0/12

How would I create a rule to whitelist all of those?

[gsamokovarov]

You can use IPAddr to represent a subnet. Something like this can work for you:

require 'ipaddr'

Rack::Attack.whitelist('allow from 199.27.128.0/21') do |request|
  IPaddr.new('199.27.128.0/21').include? request.ip
end

[ktheory]

@shanaver: I recommend @gsamokovarov's solution above. Cheers.

[bensomers]

Word to the wise: past versions of IPAddr have had very serious memory leaks - I attempted to use it in a blacklisting tool and it wasn't remotely feasible. Don't know about the current version - I believe that was on an early 1.9.2 release.

[shanaver]

thanks for the input everyone - perfect.